Aqua Security Introduces Industry-First Kubernetes Vulnerability Scanning With Trivy KBOM

Aqua Security, the pioneer in cloud-native security, announced its open-source solution - Trivy now supports vulnerability scanning for Kubernetes components in addition to Kubernetes Bill of Materials (KBOM) generation.

Companies can better understand the components within their Kubernetes environment and how secure they are to substantially reduce risk. 

Kubernetes

Kubernetes has been widely adopted across enterprises worldwide, but according to Red Hat, more than half of companies are worried about Kubernetes security, in particular, vulnerabilities and misconfigurations.

Existing infrastructure scanners scan the infrastructure for misconfigurations only and cannot analyze Kubernetes components for vulnerabilities. With this innovation in Aqua’s open-source solution, Trivy is solving this challenge for the first time.

KBOM

Help users understand how their cluster security changes over time, identify security issues, and know when to upgrade

Earlier in 2023, Aqua announced that Trivy included the KBOM generation. Much like a Software Bill of Materials (SBOM), a KBOM is the manifest of all the important components that make up the Kubernetes cluster: control plane components, node components, and add-ons, including their versions and images.

Aqua Trivy’s Kubernetes vulnerability scanning uses KBOM to help users understand how their cluster security changes over time, identify security issues and know when to upgrade cluster components.

Visibility and security

The visibility gained from KBOM generation and component vulnerability scanning is not just important for companies running their own Kubernetes environments.

Those using a managed Kubernetes service also need this level of visibility and security to determine if their service providers are using vulnerable components that may put them at risk.

Kubernetes vulnerability scanner

“Just as SBOM is critical for your application security, KBOM is critical to your infrastructure security,” said Itay Shakury, Vice President of Open Source at Aqua Security.

Itay Shakury adds, “Now, with the ability to scan the actual Kubernetes infrastructure, in addition to workloads and images, we are working toward the industry’s first complete Kubernetes vulnerability scanner. Aqua established itself as an early innovator in Kubernetes security with successful tools like kube-bench and kube-hunter, and our open-source team continues to work diligently to bring new, meaningful capabilities to our users.” 

Risk scanner

Developers can also stay up to date with the latest developments via the Aqua Open Source Slack

Kubernetes vulnerability scanning is the latest capability added to Trivy, the industry's most popular vulnerability and risk scanner. With nearly 20,000 GitHub stars, Trivy has a thriving community of users and contributors.

Developers can try Aqua Trivy’s KBOM generation to scan their cluster resources for vulnerabilities. Aqua always welcomes feedback and to improve the experience. Developers can also stay up to date with the latest developments via the Aqua Open Source Slack.

KSPM

Additionally, all KBOM features will be commercially available as part of Aqua’s Kubernetes Security Posture Management solution (KSPM) and as part of the Aqua Platform in late November.  

Aqua will be showcasing Trivy, KBOM, and other innovations during KubeCon + CloudNativeCon from the 6th – 9th November in Chicago. Stop by booth C14 to learn more about Aqua.